>quick start guide: 100 pages>NSA-madeDid they seriously expect wide adoption?
>>109366690It also breaks everything you can run on the system thoroughly.>setup webserver>webserver isn't allowed to connect to network or access files>setup database>database isn't allowed to connect to network or run its own maintenance scripts because that counts as file access99% of enterprise customers flat out disable this shit unless fedniggers require it. Feds also get hacked constantly anyway because all their infrastructure is outdated windows server trash with active directory nonsense baked into everything.
>>109366751Bro just run awkward as fuck commands like semanage permissive -a httpd_t, and my favorite semanage fcontext -a httpd_sys_content_t "/path(/.*)?" && restorecon -RF /pathLike holy fuck what the fuck were they thinking?
>>109366690It wasn't built for wide adoption. It was built for a specific purpose. Its purpose is to be extremely secure. It was built to do one thing, and it does it well. This is proven on the Android platform, the ChromeOS platform, and also, the Fedora and RHEL platforms. SELinux has had issues, like all software has had. But, SELinux has a great track record, and is in my opinion the best in its class of software. I would highly recommend SELinux for security purposes. Personally, I do not use SELinux, as my preference is for Debian, and writing a competent SEPolicy seems to be one of the things that AI struggles with at the moment. I could be wrong, as I haven't checked lately. But even with Claude Opus, as I remember it, it struggled to write a good SELinux policy. That's an example of one of the tiny (but very important) niches that AI doesn't fill for me yet.
>>109366690>expectWell it did happen, all of the relevant distros, i.e fedora based distros adopted it and Android.
>>109366780
>>109366780hi glowfag>has a great track recordLike what? All corporations and institutions that use it, get hacked every other day. What did it ever prevent?>writing a competent SELinux policy......requires to have a PhD in SELinux.And it's all sooo convenient. So it's never SELinuxs fault when something goes wrong, but it was the fault of the user, who didn't invest 5000 hours into writing correct policies.It also creats lots of busywork. You have an overcomplicated tool, so it sounds super great to some middle manager when you claim that you understand it and you can justify your worthless position.
>>109366780>But, SELinux has a great track recordHacks are more frequent and severe than ever and SELinux is almost always disabled because management is a nightmare that isn't any better than traditional security measures. All of your success story examples are platforms that have been compromised multiple times.
>>109366882corporations get hacked because they hire immigrants and women who will literally believe anything and do anything you tell them as long as you sound convincing, it is almost always social engineering and never an exploit.
>>109366926An email attachment should barely be able to do any damage in a system with "a competent SELinux policy".The very purpose of this MAC stuff is to prevent damage when a retard does something retarded.Yet all those corpos, government institutions and three letter agencies get hacked constantly.All the people who promote SELinux are from organisations that are insecure, incompetent and retarded.
>>109366926The corporation hiring immigrants and women is the one that propped up SELinux to begin with.
An idiot admires complexity, a genius admires simplicity.For an idiot, anything the more complicated it is, the more he will admire it, if you make something so clusterfucked he can't understand it he's gonna think you're a god cause you made it so complicated nobody can understand it.SELinux is for idiots.
>>109366751that's the point, tardif you need a program to have access then you whitelist it, otherwise every single program is restricted
>>109366998>An idiot admires complexity, a genius admires simplicity.>Search it online: TempleOS qouteImagine getting your quotes form a schizoid.
>>109366998Terry Davis is not the arbiter of how software must be written. Nobody is.
>>109367062* I left this out, but in regards to business, there generally are contracts. Which I'll leave that topic of discussion for another time.
>>109367026The schizoid is a million times more trustworthy than Johnson, who dropped out of college to get a nepotism job at the NSA, where he promotes overcomplicated garbage for simple problems to pretend to be smart.
>>109366767the documentation of whatever server software you run, will tell you to simply disable selinux :), rather than attempting to write a policy
>>109366690if you make it through the 100 pages you will get a job at the NSA
>>109367147only if you also raped a child or got raped as a child or bothAbusing children is the mandatory pledge of allegiance that every glowy has to do
>>109367062>>109367026Technically it's Alan Perlis who said it first.
>>109366954I wonder what happens if someone replaced white by jew or irish
A lot of dunning-kruger posts ITT
>>109366690Most of the hard work is expected to be done by your distro and the package maintainers, not you.But eventually, this will block something you don't want to and then you need to understand how it works anyway.And at that point, most people just go "ugh, annoying, let me turn this off".
>>109367188This.I work for feds and write SELinux policies for our Red Hat Enterprise Linux Workstations and we only got hacked five times in the past month.
>>109367216>feds>we only got hacked five times in the past monthLMAO
>>109366690>fall for schizoposts>switch to apparmor>get malware eventually>oops can't read a file>make a link to it>apparmor policy is path-based and the link can be readInstall SELinux NOW
>>109366954This literally looks like something a race supremacist organization would come up with.How do leftists read something like this and think "Yeah this is fine, nothing weird here"
>>109366690SELinux is just a NSA distraction from capability-based security, which is where the actual security would be.
>>109366751I have never experienced this issue at all. You're doing something wrong.
>>109369594ye because you set>permissivea long time ago and forgot about it
do major corpos actually use this
>>109366751your distro ships with selinux profilesin those profiles you'll find allowed directories for programs, what ports are assigned to what programsor you could simply overlay your own changes on top, but that requires a bunch of knowledge
>>109370438SELinux is in enforcing mode on Fedora and RHEL by default. SELinux is deeply integrated into those distributions such that packages will just work out of the box. Fedora users probably don't even realize they're using an absurdly complex security system.
>>109370342I didn't set shit. I'm using whatever Fedora defaults to.
>>109366751>webserver isn't allowed to connect to network or access filesnot every server is a webserver and you're two commands away from allowing itsame goes for not every nginx running server passing to proxies, another command to allow that>can't access filesit can, in a directory specified in the profile. for almalinux, it's anything under /srv/*/www/and even when you put the files there, you have to apply the labels recursively with another command.same goes for the databaseyou're EXPLICIT in what you allow your server to do. and it's configurable.you could even run your target services on permissive mode, then make custom modules via audit2allow reading audit logs.selinux is understandable, but being angry at it won't make it go away nor will it make you understand it.
>>109370535Try using it on any distribution that isn't Fedora, RHEL or openSUSE and tell me how easy it is to configure SELinux.
>>109370627>Try using it on <distro that doesn't care about it enough to make profiles>I don't think i will?
>>109370612NTA but audit2allow doesn't "just work", the policies in the audit log have to make sense or it will not work, also auditd only logs from when it is actually running. If something isn't logged because it ran before auditd was started, good luck trying to get that into audit2allow.
>>109370643So you're just letting the Fedora distro maintainers configure it for you and then tell everyone how simple and easy SELinux is?YOU aren't a SELinux user. You just have a hard dependency on Fedora.
>>109370646selinux doesn't magically block either. if you don't know what the software on your server is going to do then you really shouldn't run it. the only hiccups i've run into with it were sockets across cgroupv2 namespaces>>109370662why don't you just stick to containers if selinux's so scary for you? yes, redhat has the most complete profiles (obviously) but running selinux with most things on permissive, THEN securing what you need in increments is also viable. but rarely of value unless you're an actual distro maintainer.at this point i don't think you know what your threat vectors are or you're just a contrarian trying to force run selinux on a distro unprepared for it as some kind of manic genius episode.how about you specify what you want out of it first?
>>109370701or as one gnome genius used to say, what the use case?
>>109370701>selinux doesn't magically block eitherit kind of does, it denies by default unless there's a policy>if you don't know what the software on your server is going to do then you really shouldn't run it. The whole point of SELinux is to confine a daemon. If I wanted security by default I would use OpenBSD or something similar.>at this point i don't think you know what your threat vectors are or you're just a contrarian trying to force run selinux on a distro unprepared for it as some kind of manic genius episode.>how about you specify what you want out of it first?I just want to learn how to confine a daemon without the whole system being fucked up because of SELinux randomly denying things like systemd-tmpfiles or a program installer trying to set setuid to fusermount3, and causing silent data corruption in the background.
>>109370473that's actually a good thing
>>109370869Why am I not allowed to have knowledge about SELinux? Why are only distro maintainers allowed it?
>>109370880https://youtu.be/k0qmkQGqpM8...but linux is genuinely really fucking insecure
>>109370895I don't admire SELinux because it is complex. I admire it because it blocks lateral movement from compromised daemons. I want this ability.The problem is the obfuscation and mystification of SELinux. Is it being purposely made that complicated so that us commoners can't use it? Is it dangerous for the general public to know how to use SELinux?
>>109370880manpages. redhat docs. feel free to learn
>>109370932It's a total clusterfuck. There's a label called unconfined_t. You'd think this allows everything? Wrong. It still doesn't allow some things like "execmem". For that, you need unconfined_execmem_t. The problem is that nothing is allowed to change to this type. It's like an infinite rabbit hole of bullshit.
>>109370963usecase?
>>109370978I want to make my own SELinux policy that confines a daemon to rules that I define. Without fucking with the rest of the system until I tell it to. That's all I want.
>>109371014what's the issue? run permissive and define your own type
SELinux would never have been invented if namespaces came to production earlier.
>>109371030But then it will be in permissive.I want it to actually enforce the policy. And I can't do that without SELinux fucking up the rest of my system.
>>109371098selectively enforce your custom type then??? retard???
>>109371103SELinux has two modes: Permissive and Enforcing. It cannot "selectively enforce" anything, can it?
>>109371113read the manpages... retard!!!
>>109371119Are you trying to troll right now? Because this isn't very funny.
>>109371129it's possible to get there, but because of the information imbalance you'll just move the goalpost to the point of saying the equivalent of this "i want permissive but i want it to say it's enforcing"put it in permissive, set every type to permissive, set most bools to permit, put it in enforcingit's not going to solve every problem you'll pull out of your wacky ass distro, so the next step would be direct meddling in executable selinux detection and compile-time neverallow ruleshave fun, i'm out
>>109366690>Did they seriously expect wide adoption?Buckaroo... Literally every Android phone uses it
>>109366690>I don't understand something so it must be bad>All these morons talking about how selinux is hard lmaoI always knew /g/ was tech illiterate but I never realized how bad it is until today.
>>109366690
>>109366690>>109366751SELinux is not that complex in theory. It was definitely designed by security autists, though. Not the OpenBSD type, but the tranny Rust type.Maintaining SELinux from scratch is virtually impossible. You can't just install it on an OpenWrt router or something like that.
>>109370627Why would I use distributions that don't work? Are you fucking dumb? It makes no sense.>>109370662Your argument is "you don't use a distribution that is broken, therefore SELinux is bad". I don't give a shit about your mental gymnastics. I'm not using garbage distros for my private servers, I am not using them for corporate servers, I am not even using them for my PCs and laptops.Just because you keep deliberately stabbing yourself doesn't mean knives are bad.>>109370662>So you're just letting the Fedora distro maintainers configure it for you and then tell everyone how simple and easy SELinux is?Why don't you get to the skill level of Fedora maintainers then? It's already a pretty low bar, so you being unable to cross it while larping as a sysadmin is hilarious.
>>109370643>>109373281Fedoras policies are shitty. They might as well not exist.Interpreters like Python or Java aren't limited at all.Lets say you run a minecraft server.jar and have mods installed and one of the mods is malware, it will fuck you up.Protecting against such a scenario would be exactly the purpose of SELinux. But it doesn't. Because Fedora would be straight up unusable if you would have to write rules for python, java, etc.
>>109373794 (Me)That being said, i NEVER, not once in my life, saw a system with a proper SELinux configuration.A system with a good SELinux policy might as well be immutable.But then: Why not just use an immutable distro in the first place?The solution for the minecraft server.jar btw. is to run it as it's own user... rather than to go full retard and writing policies.
>>109366690>Here's this secure tool.>BTW it's a nightmare to manage :-^D>Heh, filtered. A tale as old as Linux. This is why secure practices don't get adopted.
>>109373836a secure practice is to create users for services, and that practice got adopted 30 years ago alreadySELinux is a corporate glowfag product and has all the issues that corpo products always have. Like Windows, think about those Windows MAC rules. Not a single person makes use of that bullshit.Corporate loves busywork.
By this thread I'm assuming /g/ is an apparmor crowd, no?
>>109370920You are just low IQ
>>109373885It is manageable. Can't say many bad things about it.Glowfags will tell you that its bad because its path based... but that is actually the only reasonable approachexample:>run a samba network share>write proper selinux policies for it, to have a common public read only shared folder>have everything setup correctly, all looks good and works>creating files inside the folder sets all the correct permissions and its accessible>have a file from a different folder i want to share>drag & drop it into the samba folder>its there>access it over the network>whooop whooop permission denied whooop whoopif you move a file, you move its attributes with it and therefor, even if you set all policies correct, it sticks with the attributes of its original folder it was in :DYou WILL run an obscure restorecon command every time you want to add something to the samba share, that you didnt create there.AppArmor doesn't have this problem.
>>109373964>drag & drop it into the samba foldernot necessarily defending selinux, but the way they always recommend these scenarios is to copy them over since the system will automatically generate the proper selinux contexts.
>>109374083>nooo you are using it incorrectlykeksoftware should serve the needs of the users, not the other way around
>>109374083>just copy the file and then delete the original, rather than movingImagine how dumb this is. Imagine telling your office drones this.Imagine how many problems this will cause on your corporate RHEL workstation in your NSA office that Shaquilla works on.That one thing alone is the reason why you will never a an actually proper setup SELinux system.If you think about it, the first thing you would want to use it for is to stop everything else from accessing a browser profile (most common current way to get hacked), and to stop your browser from accessing anything it shouldn't. So the Download folder of the browser would have a cuck context.Imagine a system that would actually do this. The basic functionality of moving files would be useless, because every file, that enters the system, would start in a cuck folder and have a cuck state per default.
source: opensource.com
>>109374322there is a book that teaches the basic aspects of SElinux in a format that is similar to childrens story books.Forgot what it was called but it literally used animals and food as analogies.
>>109374459
>>109373830>Why not just use an immutable distro in the first place?What do you think most of the professional industry uses? Docker containers are effectively immutable. Even if it's hobby use, only a total tard would use a raw server that is manually configured.
>>109366690The NSA built it for the DoD retards so they can die for Israel more efficiently
>>109374761>What do you think most of the professional industry uses?An Oracle subscription for their cloud services and Oracle DB with regular audits and lawsuits, whenever Oracle feels like extorting more money out of you.The "professional industry" is full of mouth breathing idiots.
>>109366690On gentoo you either use SELinux or nothing. AppArmor is not maintained which means you get to write gazillion rules for all packages.
skill issue kek
>>109366690As a hacker whenever I find a box running SELinux I immediately nop the fuck out of there and send them some crypto so they don’t come track me down and kill me. There’s nothing scarier than a cybersecurity professional.
>>109376673It's funny because a box running SELinux is just Fedora or RHEL with the default SELinux config and the user probably doesn't even know they're running SELinux
>>109370535>I didn't set shit. I'm using whatever Fedora defaults to.what is the output of getenforce?
>>109376798>Enforcing
>>109366998And a country-grown vegetable admires random quotes pushed by tech bros.
>>109366751>>setup webserver>>webserver isn't allowed to connect to network or access files>>setup database>>database isn't allowed to connect to network or run its own maintenance scripts because that counts as file accessbased
if you're bound by nist/fips rules or whatever your national equivalent is it gets you a lot of audit checkboxes for free and that's its use case.
>>109379245This. Ppl keep saying how android is using SELinux with no issues but they forget Android has a simple and robust permission system that Linux autists REFUSE to implement. Nigga, I just want this webserver to bind to this port, then make a setup wizard asking for it in plain English, I am NOT gonna scour mailing lists for some arcane incantation like >seallow::permissive::anon_t 69->allow /usr/local/bin/nginx [ALL:ALL]and then run some bullshit sequence of commands to compile it into the policykit that gets reset after an update next week.
>>109381289>Android has a simple and robust permission system that Linux autists REFUSE to implement.It's already mostly implemented. Flatpak.
>>109381289>Android has a simple and robustThat they change every other day and that works on the basis of: Every App has its own user.Which is a security concept we use for multiple decades now and that Google copied.And yet, every second Android app is malware stealing your data.
>>109382706>every second Android app is malware stealing your datacitation neededi bet it's all retarded normalniggers pressing yes to all prompts to just see bam-boom-woosh on screengoogle locking down app installation is based
>>109381289>Linux autists REFUSE to implement.You mean, Google forced every single Android app to conform to? Nobody would bother with this humiliation ritual of permissions if Google wasn't the other half of the de-facto monopoly on mobile OSes.
>>109366690you don't have to read it
>>109366954>picapplies to every normalfag egregore>>109366998>An idiot admires complexity, a genius admires simplicity.Terry was so based. RIP.
>>109385451All they had to do was to make it so when a program wants to do something potentially dangerous you are asked for permission. This exists on MacOS btw so it's not impossible.My bet it is not on Linux because the software is so fragmented it's impossible to do anything. Once you a permission asking daemon >some troon will rewrite it in rust with an idiotic spec and call it Permland>glowhat will make systemd-permd>chuds will make a suckmore clone in 1000 LOC but it only works on basic cases without patches (all outdated btw)>freedesktop will shit out some retarded protocol nobody respects everand so on.
secureblue just works
>>109389209nocoder detected
>>109366690110 pages if you include the animal food analogies
